Least privilege
Give each user only the access needed to perform their assigned responsibilities. Separate viewing, management, approval, export, and system-administration authority.
Review regularly
Review access when responsibilities change, a matter closes, a professional relationship ends, or a security event occurs.